Subverting Environment Variable Values
Attack Pattern ID: 13 (Standard Attack Pattern Completeness: Complete)Typical Severity: Very HighStatus: Draft
+ Description


The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.

Attack Execution Flow

  1. The attacker probes the application for information. Which version of the application is running? Are there known environment variables? etc.

  2. The attacker gains control of an environment variable and ties to find out what process(es) the environment variable controls.

  3. The attacker modifies the environment variable to abuse the normal flow of processes or to gain access to privileged ressources.

+ Attack Prerequisites

An environment variable is accessible to the user.

An environment variable used by the application can be tainted with user supplied data.

Input data used in an environment variable is not validated properly.

The variables encapsulation is not done properly. For instance setting a variable as public in a class makes it visible and an attacker may attemp to manipulate that variable.

+ Typical Likelihood of Exploit

Likelihood: Very High

+ Methods of Attack
  • Injection
  • Modification of Resources
  • Protocol Manipulation
+ Examples-Instances


Environment variables

Changing the LD_LIBRARY_PATH environment variable in TELNET will cause TELNET to use an alternate (possibly Trojan) version of a function library. The Trojan library must be accessible using the target file system and should include Trojan code that will allow the user to log in with a bad password. This requires that the attacker upload the Trojan library to a specific location on the target.

As an alternative to uploading a Trojan file, some file systems support file paths that include remote addresses, such as \\\shared_files\trojan_dll.dll.

Related Vulnerabilities

Path Manipulation (CVE-1999-0073)

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Low

In a web based scenario, the client controls the data that it submitted to the server. So anybody can try to send malicious data and try to bypass the authentication mechanism.

Medium/High: Some more advanced attacks may require knowledge about protocols and probing technique which help controling a variable. The malicious user may try to understand the authentication mechanism in order to defeat it.

+ Probing Techniques

An attacker can intentionally modify the client side parameter and monitor how the server behaves in response to that modification. For instance an attacker will look at the cookie data, the URL parameters, the hidden variables in forms, variables used in system calls, etc.

If the client uses a program in binary format to connect to the server, disassembler can be used to identify parameter within the binary code, and then the attacker would try to simulate the client application and change some of the parameters sent to the server. For instance the attacker may find that a secret key or a path is hard coded in the binary client application.

Environment variables are frequently stored in cleartext configuration files. If the attacker can modify those configuration files, he can control the environment variables. Even a read access can potentially be dangerous since this may give sensitive information to perform this type of attack. Indeed knowing which environment variables the application uses is a prerequisite to this type of attack.

+ Obfuscation Techniques

The attacker may try to obfuscate its attempts to subvert the target process (such as authentication) by using valid values for the variable she controls. By using valid values the user tries to understand the authentication mechanism. This would be in preparation to a more serious attack.

+ Solutions and Mitigations

Protect environment variables against unauthorized read and write access.

Protect the configuration files which contain environment variables against illegitimate read and write access.

Assume all input is malicious. Create a white list that defines all valid input to the software system based on the requirements specifications. Input that does not match against the white list should not be permitted to enter into the system.

Apply the least privilege principles. If a process has no legitimate reason to read an environment variable do not give that privilege.

+ Attack Motivation-Consequences
  • Run Arbitrary Code
  • Privilege Escalation
  • Denial of Service
  • Information Leakage
+ Injection Vector

The client controlled parameter

+ Payload

The new value of the client controlled parameter.

+ Activation Zone

The activation zone is the server side function where the client controlled parameter is consumed.

+ Payload Activation Impact

Consuming an attacker contolled parameter can defeat the normal process of the application.

+ Related Weaknesses
CWE-IDWeakness NameWeakness Relationship Type
353Failure to Add Integrity Check ValueTargeted
285Improper Access Control (Authorization)Secondary
302Authentication Bypass by Assumed-Immutable DataTargeted
74Failure to Sanitize Data into a Different Plane ('Injection')Targeted
15External Control of System or Configuration SettingTargeted
73External Control of File Name or PathTargeted
20Improper Input ValidationSecondary
200Information ExposureSecondary
+ Related Vulnerabilities
Vulnerability IDRelationship Description

SQL-Ledger 2.4.4 through 2.6.17 authenticates users by verifying that the value of the sql-ledger-[username] cookie matches the value of the sessionid parameter, which allows remote attackers to gain access as any logged-in user by setting the cookie and the parameter to the same value.


enter.asp in Mini-Nuke 2.3 and earlier makes it easier for remote attackers to conduct password guessing attacks by setting the guvenlik parameter to the same value as the hidden gguvenlik parameter, which bypasses a verification step because the guvenlik parameter is assumed to be immutable by the attacker.


SecurityDatabase\User\Admin/admin.php in phpBazar 2.1.0 and earlier allows remote attackers to bypass the authentication process and gain unauthorized access to the administrative section by setting the action parameter to edit_member and the value parameter to 1.


base_maintenance.php in Basic Analysis and Security Engine (BASE) before 1.2.4 (melissa), when running in standalone mode, allows remote attackers to bypass authentication, possibly by setting the standalone parameter to "yes".

+ Related Attack Patterns
NatureTypeIDNameDescriptionView(s) this relationship pertains toView\(s\)
PeerOfAttack PatternAttack Pattern10Buffer Overflow via Environment Variables 
Mechanism of Attack1000
CanPrecedeAttack PatternAttack Pattern14Client-side Injection-induced Buffer Overflow 
Mechanism of Attack1000
ChildOfAttack PatternAttack Pattern77Manipulating User-Controlled Variables 
Mechanism of Attack1000
ChildOfAttack PatternAttack Pattern264Environment variable manipulation 
Mechanism of Attack (primary)1000
ParentOfAttack PatternAttack Pattern38Leveraging/Manipulating Configuration File Search Paths 
Mechanism of Attack1000
ParentOfAttack PatternAttack Pattern76Manipulating Input to File System Calls 
Mechanism of Attack1000
+ Related Security Principles
  • Reluctance to trust

+ Related Guidelines
  • Always perform wise data validation. Do not accept tainted data without validation. Do not simply base authentication on the client controlled parameter.

  • Avoid relying on client side validation only.

+ Purposes
  • Penetration
+ CIA Impact
Confidentiality Impact: MediumIntegrity Impact: HighAvailability Impact: Low
+ Technical Context
Architectural Paradigms
+ References
G. Hoglund and G. McGraw. "Exploiting Software: How to Break Code". Addison-Wesley. February 2004.

CWE - Input Validation

+ Content History
G. Hoglund and G. McGraw. Exploiting Software: How to Break Code. Addison-Wesley, February 2004.Cigital, Inc2007-03-01
Eric DalciCigital, Inc2007-02-13Fleshed out content to CAPEC schema from the original descriptions in "Exploiting Software"
Sean BarnumCigital, Inc2007-03-05Review and revise
Richard StruseVOXEM, Inc2007-03-26Review and feedback leading to changes in Name, Description and Related Attack Patterns
Sean BarnumCigital, Inc2007-04-13Modified pattern content according to review and feedback